Trying to understand more about "minor" auto-updates

Hi,

I run/maintain multiple WordPress sites and I’ve seen a couple of things happening recently with regards to the WordPress core auto-updates for security patches (e.g. going from 3.8.5 > 3.8.6, 3.9.3 > 3.9.4, 4.1.1 > 4.1.2, etc.).

I often have clients that come to me with sites that were hosted somewhere else and now wants me to host them. Those sites are often outdated and once I get them up and running on my server, they don’t get auto-updated which I hoped would happen hence making my life a bit easier.

One exemple I did last week was a version 3.8.1 but it wouldn’t update up to 3.8.8. Is that normal? Is there a “cut-off” point where a WordPress previous version won’t update automatically?

I know the cron is triggered since I’m navigating the site constantly. That got me thinking: Are those auto-updates supposed to kick-in the moment the cron starts or are they meant in such a way that they run on a given time of the day (at night for example)?

For added context, let me add the following. I’ve found lots of topics on how to disable it (which I don’t want to do) and a couple of people having similar issues like I do. To prevent any external factor, I tested with the following:
– i disabled all the plugins
– switched the custom theme to a Twenty-? theme (tried fourteen and fifteen)
– tried both with language set to french and english.

The servers I have tested are both Windows server… tried IIS and Apache, both getting the same results. Any help you can provide will be greatly appreciated!

Many thannks